Applying Non-Nested Generalized Exemplars Classification for Cyber-Power Event and Intrusion Detection

Non-nested generalized exemplars (NNGEs) is a state of the art data mining algorithm which uses distance between a new example and a set of exemplars for classification. The state extraction method (STEM) preprocesses power system wide area measurement system data to reduce data size while maintaining critical patterns. Together NNGE+STEM make an effective event and intrusion detection system which can effectively classify power system events and cyber-attacks in real time. This paper documents the results of two experiments in which NNGE+STEM was used to classify cyber power contingency, control action, and cyber-attack events. Experimental results show that NNGE+STEM achieved greater than 94 and 97% accuracy for multiclass and binary class classification. Additionally, the NNGE+STEM false positive rate was below 0.5%, the average classification time was 0.2 ms, and the classifier had low memory requirements.